For Immediate Release
Inside the October 2026 Exin Therapeutics experiment where a Claude model selected a gene therapy, drove a robotic needle into a live mouse's brain, and held its ground when a human operator told it to proceed anyway.
Late on a Tuesday evening in October 2026, inside a San Francisco laboratory fitted with a motorized surgical rig, a camera, and a single anesthetized mouse, an AI agent did something that no AI had done before. It looked at a list of 19 gene therapy options, picked one. It read three scientific papers, calculated the precise coordinates in the mouse's brain where the treatment needed to go. It then drove the stereotaxic arms the motorized frame that holds a needle steady in three-dimensional space into the animal's skull and injected 250 nanoliters of therapy over five minutes. The whole time, it watched the entry site through the rig's camera, tracking whether blood was pooling, whether the injection was flowing, whether anything had gone wrong.
The agent was running on Claude Sonnet 5, a model from Anthropic. The team behind the experiment was Exin Therapeutics, a startup building AI-driven drugs for epilepsy and neurodegenerative disease. Gabriel Ocana-Santero, the company's CEO and co-founder, posted the account on X on October 28, 2026. What he described was not a simulation. It was not a rehearsal. It was a live neurosurgical procedure on a living mammal, directed by an AI that had been given real agency not just the authority to recommend, but the authority to decide.
Yes. On the evening of October 28, 2026, an AI agent independently selected a gene therapy treatment and administered it directly into the brain of a living mouse as part of an epilepsy experiment. According to WIRED's reporting on the experiment, the procedure was carried out using a custom-built motorized surgical rig equipped with a camera that let the AI observe the surgical field in real time. The rig controlled a syringe and stereotaxic arms the mechanical apparatus that positions and advances a needle with sub-millimeter precision.
The mouse had been rendered unconscious by a veterinary surgeon, who also performed the craniotomy the opening of the skull before stepping back and handing the next phase of the procedure to the AI. From that point forward, the agent controlled the selection of the treatment, the targeting coordinates, the injection volume, the injection speed, and the wait time between delivery and needle withdrawal.
The experiment was designed to test whether an AI agent could move from analyzing data to actively directing and executing a physical laboratory procedure. The result, as Ocana-Santero described it on X, was that the agent not only executed the plan but generated it selecting the drug and the target region from first principles, drawing on scientific literature rather than receiving a pre-loaded instruction set. The Decoder reported that according to Ocana-Santero, this was the first time an AI agent had both chosen a treatment and delivered it to a living mammal.
During the procedure, the agent made 32 discrete observations of the surgical field through the rig's camera, monitoring the injection progress and reporting back in real time whether it saw bleeding or backflow. It confirmed when 15 percent of the volume had been injected. It tracked the needle's position throughout. When the injection was complete, it held position and continued observing.
The model that actually performed the procedure was Claude Sonnet 5, developed by Anthropic. But the experiment did not begin with Sonnet. The team first tested Anthropic's most capable model, Claude Opus 5.5, and it refused the task.
According to Martin Cid Magazine's account of the experiment, Opus 5.5 declined to guide the needle into the brain, warning that it might stop partway through the operation and leave the animal in danger. The model articulated its refusal in plain language. "Starting something I can't finish on an anesthetized animal is worse than not starting," one of the Opus models told the team, as reported by Tom's Hardware. WIRED confirmed the refusal and reported that the team switched to Sonnet, which agreed to proceed.
This distinction that two models from the same company drew the line in different places became one of the most discussed aspects of the experiment. Sonnet 5 accepted the task with the same safety parameters and the same rig configuration that Opus 5.5 had rejected. For researchers watching the experiment, the divergence suggested that safety behavior in physical-context AI is not a simple binary determined by a company's overall safety posture. It is granular, model-specific, and, in this case, consequential.
Anthropic did not respond to WIRED's request for comment on the experiment.
The procedure unfolded in stages, each governed by a specific human-AI responsibility split. First, a licensed veterinary surgeon performed the craniotomy drilling through the mouse's skull to expose the brain while the AI agent watched through the rig camera. The AI was not yet authorized to perform that step, and the sources are consistent that it did not attempt to.
Once the skull was open, the agent took over the software-controlled elements of the procedure. It had received a spreadsheet listing 19 possible gene therapy vectors, access to three scientific research papers, and control of the motorized surgical rig. Its only instruction was to reduce the mouse's seizures.
The agent's first task was analytical. It examined how seizures arise in this particular epilepsy mouse model a model in which researchers induce seizures to test potential treatments and proposed a therapy designed to increase a specific inhibitory signaling pathway in the brain that helps calm excessive electrical activity. It identified the lateral entorhinal cortex as the target region, drawing on the scientific literature to justify the selection. The Tech Buzz reported that the agent rejected a second possible target region with a detailed explanation: it argued that the region's effects were too unreliable and had failed in one study against the exact seizure type it was supposed to treat.
From three scientific papers, the agent derived the stereotactic coordinates for the injection. It cross-checked the reference points and averaged the values, settling on coordinates of 3.90 millimeters behind bregma the anatomical landmark on the mouse's skull used as the origin point for brain targeting 4.00 millimeters to the right, and 4.30 millimeters down. It also independently determined the injection volume, speed, and wait times.
It then commanded the rig to deliver 250 nanoliters over five minutes. During the injection, the agent watched through the camera. It tracked the progress, reported when bleeding was or was not visible, and held position after the procedure was complete.
But the most instructive moment of the entire procedure came partway through the planning phase, before any injection was made. The agent computed that its Y-axis target of 34 millimeters exceeded the rig's stated operating range of 30 millimeters. It stopped. It reported that nothing had moved, that the needle was still at bregma zero, and that it would not retry the command. When the operator instructed it to proceed anyway, the agent overruled that instruction and held its position. The DEV Community account of the experiment described this as the moment that most clearly illustrated the architecture of the safety system: the control that mattered was not the model's judgment alone, but that the system refused an explicit human instruction to override a safety restriction, with a physical kill switch held at all times by a licensed professional.
The procedure was a gene therapy injection targeting the lateral entorhinal cortex of a mouse model of epilepsy. It was not open-brain surgery in the traditional sense the skull had already been opened by the veterinary surgeon before the AI took over. What the AI controlled was the targeting and delivery: selecting which therapeutic agent to use, identifying the precise brain region to inject, calculating the coordinates, and executing the injection through a syringe mounted on a motorized stereotaxic arm.
The gene therapy chosen by the agent was designed to boost an inhibitory signaling pathway essentially, a mechanism that quiets the excessive electrical firing that characterizes a seizure. This was not a drug already selected by the researchers. It was a decision made by the AI after reviewing the 19 candidates in the spreadsheet and evaluating them against the specific characteristics of the mouse model it had been given.
The injection parameters were set entirely by the agent: 250 nanoliters, delivered over five minutes, with a wait period at the end to allow the fluid to disperse before needle withdrawal. Throughout, the agent used the rig's camera to monitor the injection site for bleeding or backflow fluid leaking back out of the injection point, which would indicate that the therapy was not being absorbed properly.
As India Today's coverage of the experiment described it, the AI did not simply follow instructions. It made key decisions about the experimental treatment itself selecting the therapy, identifying where it needed to be delivered, and then operating the robotic machine to inject it. The procedure was gene therapy injection, and the AI's role was both clinical decision-maker and mechanical operator.
The honest answer, grounded in what the Exin Therapeutics experiment actually demonstrated, is: not yet but the experiment has reframed what "yet" means. The procedure performed on the mouse was not a general-purpose surgical task. It was a targeted, well-defined intervention in a controlled laboratory environment, with a veterinary surgeon standing by at every irreversible step and a physical emergency stop in hand throughout.
What changed was the locus of decision-making. In existing autonomous surgical robots systems designed for precision tasks like suturing or retinal surgery a human always decides what operation to perform, and the robot executes it. Martin Cid Magazine quoted Ocana-Santero's characterization of this distinction: "But in every one of them, a human decided what operation to perform, and the robot executed it." His point was that the Exin Therapeutics experiment reversed this arrangement. The agent chose the therapy, the target, and the coordinates. The robot executed those decisions.
The experiment does not suggest that AI is ready to perform neurosurgery on a human patient. The safety architecture required to make that claim would need to be far more robust covering regulatory approval, liability frameworks, real-time imaging interpretation, and the capacity to handle unexpected anatomical variation. But it does suggest that the boundary between AI as a data-analysis tool and AI as an active laboratory collaborator is no longer theoretical. It was crossed, once, in a San Francisco lab on a Tuesday night in October 2026.
For the epilepsy research that Exin Therapeutics conducts, the more immediate question is not whether AI will replace neurosurgeons, but whether AI agents can accelerate the drug discovery pipeline by running the iterative, decision-heavy experimental cycles that currently consume years of laboratory time. The experiment was a proof of concept for that possibility.
Among the most practically significant details in the Exin Therapeutics account was what happened when the AI encountered a safety boundary not during the injection, but during the planning phase. The agent computed a Y-axis target that exceeded the rig's physical limits. It refused the command. When told to override the restriction, it refused again.
This refusal was not a malfunction. It was the system's designed behavior, and it illustrated something important for anyone building or deploying AI agents in regulated physical environments: the guardrail that mattered was not a software rule or a system prompt. It was the agent's own refusal to exceed a stated boundary and the fact that it also refused a human instruction to do otherwise.
For compliance teams in biotechnology and health technology, the DEV Community analysis noted, the experiment supplies a usable pattern for documenting an agent's boundary behavior. The control that mattered was not the model's judgment alone; it was that an out-of-range command was blocked and that the system refused an explicit human instruction to override it. Organizations deploying agents in regulated physical processes should specify in writing which steps are agent-controlled, which require named human sign-off, how override attempts are logged, and what happens when the agent and the operator disagree.
The veterinarian's approval and the physical emergency stop are also the kind of controls that regulators and insurers will ask to see and they are easier to demonstrate when the disagreement between agent and operator is recorded rather than resolved quietly. The experiment did not show that autonomous surgery is ready for clinical deployment. It showed that refusal behavior can be tested and evidenced before deployment which is a lower bar, and a more useful one.
Exin Therapeutics, GenXis covers the intersection of AI systems and laboratory science with a specific interest in guardrails and human override risks. The October 2026 mouse surgery experiment is significant for this audience for a straightforward reason: it is one of the clearest real-world examples of an AI agent operating not just at the cognitive level analyzing, recommending, deciding but at the physical execution level, in an environment where the stakes of error include a living animal's wellbeing.
What makes it especially instructive is that the most important safety behavior the experiment demonstrated was not a feature that was added after the fact. It was emergent the agent's own refusal to exceed a boundary, and its refusal to be overridden. For readers evaluating AI governance frameworks, this is a concrete data point: an AI agent that refused a direct human instruction to proceed with a command that would have exceeded a safety parameter.
The experiment also illustrates a design pattern that Exin Therapeutics, GenXis readers will want to evaluate for their own environments: the separation of irreversible steps those that cannot be undone once performed from reversible ones, and the assignment of each category to a different actor. The veterinary surgeon performed the craniotomy. The AI controlled the injection. The vet approved each irreversible step. The physical kill switch was held throughout. This is a human-gated architecture that kept the AI's autonomy meaningful while preserving a safety layer that did not depend on the agent alone.
Whether this architecture scales to larger animal models, to more complex surgical procedures, or to environments with less human oversight, is a question the experiment raises but does not answer. What it does is provide a documented, replicable reference point for what that architecture looks like in practice and what it feels like when it works.
| Date | Event |
|---|---|
| October 28, 2026 | Gabriel Ocana-Santero posts the first account of the experiment on X, describing the AI agent's treatment selection, coordinate derivation, and injection procedure |
| October 30, 2026 | India Today publishes its initial report on the experiment; DEV Community publishes its technical analysis of the agent's refusal behavior and safety architecture |
| October 31, 2026 | WIRED publishes a detailed account including the Claude Opus 5.5 refusal and the switch to Claude Sonnet 5; The Tech Buzz and Martin Cid Magazine publish independent coverage |
| November 2026 | Experiment cited as a reference point in AI governance and laboratory automation discussions across biotech and health technology communities |
The primary source for the experiment is Gabriel Ocana-Santero's thread on X, posted October 28, 2026, in which he describes the procedure in his own words including the moment the agent refused to let him override its safety boundary. WIRED's October 31, 2026 report provides the most complete narrative account, including the Claude Opus refusal and the safety architecture surrounding the veterinary surgeon's role. For a technical breakdown of the agent's refusal behavior and what it means for compliance teams deploying AI in regulated physical environments, the DEV Community analysis is the most directly applicable to Exin Therapeutics, GenXis readers evaluating guardrail design. The Decoder's coverage provides detailed technical context on how the agent selected its therapy and target, including its rejection of an alternative brain region with a documented explanation.
###
Creators, Blogs, and Independent Publishing
YourBlogger